656591 - TI+JM: [infer failure] Missing type at #2:00028 pushed 0: void

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
(function () {
    var i = 0; 
    (function () {
        var x;
        (x = "") || 1;
        (x = "")(i || x);
    })();
})();
--
$ ./js -a -n -m test.js
[infer failure] Missing type at #2:00028 pushed 0: void

Revision 5bcf457d942c, 32-bit OS X.

Comment 1

[Brian Hackett [Laid off!]]

Better fix for the issue exposed by bug 655508, which just papered over the real problem.  After writing to a local, if that local is dead we would skip writes of its payload and type tags.  At a joint point, however, we would assume a synced known type for all entries, and if an entry was overwritten with a new value of the same type we wouldn't bother to write out a new type tag.

To fix this dissonance, at join points we don't mark any known type for dead entries.  This better reflects the state of the world: the value in memory isn't the variable's actual value (which won't be observed), and the in-memory type of that value is not known.

http://hg.mozilla.org/projects/jaegermonkey/rev/9e0bab2c04b4